| Package | Affected versions | Patched versions |
|---|---|---|
| studio-42/elfinder | < 2.1.67 | 2.1.67 |
| elfinder | < 2.1.67 | 2.1.67 |
High
bg can be injected into shell command construction, leading to possible RCE in affected configurations.
elFinder contains a command injection vulnerability in the resize command.
The bg (background color) parameter is accepted from user input and passed through image resize/rotate processing. In configurations that use the ImageMagick CLI backend, this value is incorporated into shell command strings without sufficient escaping. An attacker able to invoke the resize command with a crafted bg value may achieve arbitrary command execution as the web server process user.
This issue affects configurations where:
resize command is enabled,An attacker may execute arbitrary OS commands with the privileges of the web server process.
Impact depends on server configuration, enabled commands, backend image library selection, and surrounding deployment controls.
Affected: all versions before 2.1.66 Patched: 2.1.67
The vulnerable flow is:
resize command accepts the bg parameter from the request.The issue was addressed by:
bg against a strict allowlist of supported color formats, andPossible mitigations for users who cannot upgrade immediately:
resize command if not required,Upgrading to the patched release is strongly recommended.
Thanks to Lin, WeiChi and Drew Webber for the responsible disclosure.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free